1

I am trying to access SharePoint UserGroup service using a Java client. I have generated the stubs from the WSDL using axis2-1.6.2 and using the following code to access the user group but getting following exception:

org.apache.axis2.AxisFault: Transport error: 401 Error: Unauthorized

HttpTransportProperties.Authenticator auth = new HttpTransportProperties.Authenticator();
auth.setUsername(username);
auth.setPassword(password);
auth.setDomain(domain);
auth.setHost(host);
auth.setPort(80);

List authPrefs = new ArrayList(1);
authPrefs.add(AuthPolicy.NTLM);
auth.setAuthSchemes(authPrefs);

UserGroupStub userGrp = new UserGroupStub("http://domainName/ProjectName/_vti_bin/UserGroup.asmx");

// Set authenticator
            userGrp._getServiceClient().getOptions().setProperty(org.apache.axis2.transport.http.HTTPConstants.AUTHENTICATE, auth);
            userGrp._getServiceClient().getOptions().setProperty(org.apache.axis2.transport.http.HTTPConstants.HTTP_PROTOCOL_VERSION, org.apache.axis2.transport.http.HTTPConstants.HEADER_PROTOCOL_10);
userGrp._getServiceClient().getOptions().setTimeOutInMilliSeconds(10000);
// Get request and execute
GetUserCollectionFromGroup req = new GetUserCollectionFromGroup();
req.setGroupName(grpName);
GetUserCollectionFromGroupResponse res = userGrp.getUserCollectionFromGroup(req);
Improve this question
6
  • Please check in the IIS Log which http error code is emitted. 401.1, 401.2, etc. have different meaning and solutions. You have to find the status and substatus in the log (or does the java client is telling it)? Norbert's answer is probably the correct one. The substatus will help ton confirm (or not!) it. Also, you should give us a bit of more details, which version of sharepoint and windows are your running ?
    – Steve B
    Commented Jul 6, 2012 at 14:03
  • I am using sharepoint 2010 and XP SP3. I see the following log: 2012/07/07 20:06:41:442 IST [DEBUG] header - << "HTTP/1.1 401 Unauthorized[\r][\n]" 2012/07/07 20:06:41:442 IST [DEBUG] header - << "Content-Type: text/html; charset=utf-8[\r][\n]" 2012/07/07 20:06:41:442 IST [DEBUG] header - << "Server: Microsoft-IIS/7.5[\r][\n]" 2012/07/07 20:06:41:442 IST [DEBUG] header - << "SPRequestGuid: 15c6411c-1b6e-4e30-a894-40333daa1241[\r][\n]" 2012/07/07 20:06:41:442 IST [DEBUG] header - << "WWW-Authenticate: Negotiate[\r][\n]"
    – sulvik
    Commented Jul 9, 2012 at 5:40
  • this is not a iis log, and you don't us which version of windows on server side you are running. By default IIS logs are located in C:\inetpub\logs\LogFiles
    – Steve B
    Commented Jul 9, 2012 at 7:21
  • I have not been able to get details of the version & IIS logs. The logs that I sent are full wire logs from the httpclient.
    – sulvik
    Commented Jul 9, 2012 at 11:29
  • If you notice the first handshake returns HTTP/1.1 401 Unauthorized and WWW-Authenticate: Negotiate; WWW-Authenticate: NTLM; but able to figure how to make subsequent req. Looks like its not a one step process. 1: C --> S GET ... 2: C <-- S 401 Unauthorized WWW-Authenticate: NTLM 3: C --> S GET ...Authorization: NTLM <> 4: C <-- S 401 Unauthorized WWW-Authenticate: NTLM <> 5: C --> S GET ...Authorization: NTLM <> 6: C <-- S 200 Ok
    – sulvik
    Commented Jul 9, 2012 at 11:39

3 Answers 3

Reset to default
1

If the Java Client is running on a different server than the Sharepoint Webservice (and I think this is probably the case) and the AD account, under which your client process runs, is different from the account you use to authenticate with on the webservice, then I think you have a double-hop issue, due to the fact that you are trying to use NTLM.

NTLM is not able to delegate user credentials, which would be required in the following scenario: Process A is trying to access Service B but with the credentials of User C. This means that A should be able to delegate C's credentials to B, but because of NTLM, it cannot. In order to delegate user credentials, you should use Kerberos instead of NTLM. But be aware, that Kerberos is more difficult to configure and set up.

A more detailed explanation on the difference between NTLM and Kerberos, you can find here: http://blogs.msdn.com/b/besidethepoint/archive/2010/05/09/double-hop-authentication-why-ntlm-fails-and-kerberos-works.aspx

Improve this answer
1
  • Yes. java client is running on a different server that sharepoint. But, my AD account where the client process is running is the same credentials that i am using to authenticate my service. The same service is getting called successfully using .NET client:
    – sulvik
    Commented Jul 7, 2012 at 12:59
1

If you extend your web application in Sharepoint Central Admin and set the extended web application as anonymous access, then set anonymous access on your web application or site you will avoid the authentication 401 error.

Improve this answer
0

Have you tried activating the “basic authentication” for your SharePoint site in the IIS settings of your server?

It is also worth a try, if you change anonymous access to the root wsdl on your SharePoint server to open the service port.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.